Advanced logging

This section explains how to configure other log features within your existing log configuration. You may want to include other log features after initially configuring the log topology because the network has either outgrown the initial configuration, or you want to add additional features that will help your network’s logging requirements.

Configuring logging to multiple Syslog servers

When configuring multiple Syslog servers (or one Syslog server), you can configure reliable delivery of log messages from the Syslog server. Configuring of reliable delivery is available only in the CLI.

If VDOMs are enabled, you can configure separate FortiAnalyzer unit or Syslog server for each VDOM.

To enable logging to multiple Syslog servers

Log in to the CLI.

Enter the following commands:

config log syslogd setting

set csv {disable | enable}

set facility <facility_name>

set port <port_integer>

set reliable {disable | enable}

set server <ip_address>

set status {disable | enable}

end

Enter the following commands to configure the second Syslog server:

config log syslogd2 setting

set csv {disable | enable}

set facility <facility_name>

set port <port_integer>

set reliable {disable | enable}

set server <ip_address>

set status {disable | enable}

end

Enter the following commands to configure the third Syslog server:

config log syslogd3 setting

set csv {disable | enable}

set facility <facility_name>

set port <port_integer>

set reliable {disable | enable}

set server <ip_address>

set status {disable | enable}

end

Most FortiGate features are, by default, enabled for logging. You can disable individual FortiGate features you do not want the Syslog server to record, as in this example:

config log syslogd filter

set traffic {enable | disable}

set web {enable | disable}

set url-filter {enable | disable}

end

Using Automatic Discovery to connect to a FortiAnalyzer unit

Automatic Discovery can be used if the FortiAnalyzer unit is on the same network.

To connect using automatic discovery

Log in to the CLI.

Enter the following command syntax:

config log fortianalyzer setting

set status enable

set server <ip_address>

set gui-display enable

set address-mode auto-discovery

end

If your FortiGate unit is in Transparent mode, the interface using the automatic discovery feature will not carry traffic. For more information about how to enable the interface to also carry traffic when using the automatic discovery feature, see the Fortinet Knowledge Base article, Fortinet Discovery Protocol in Transparent mode.

The FortiGate unit searches within the same subnet for a response from any available FortiAnalyzer units.

Activating a FortiCloud account for logging purposes

When you subscribe to FortiCloud, you can configure to send logs to the FortiCloud server. The account activation can be done within the web-based manager, from the License Information widget located in Dashboard.

From this widget, you can easily create a new account, or log in to the existing account. From within the License Information widget, after the account is activated, you can go directly to the FortiCloud web portal, or log out of the service if you are already logged in.

To activate a FortiCloud account for logging purposes:

The following assumes that you are already at Dashboard and that you have located the License Information widget.

In the License Information widget, select Activate in the FortiCloud section. The Registration window appears. From this window, you create the login credentials that you will use to access the account.

Select Create Account and enter then information for the login credentials. After entering the login credentials, you are automatically logged in to your FortiCloud account.

Check that the account has been activated by viewing the account status from the License Information widget.

If you need more space, you can subscribe to the 200Gb FortiCloud service by selecting Upgrade in the FortiCloud section of the widget.

Viewing log storage space

The diag sys logdisk usage command allows you to view detailed information about how much space is currently being used for logs. This is useful when you see a high percentage, such as 92 percent for the disk’s capacity. The FortiGate unit uses only 75 percent of the available disk capacity to avoid a high storage amount so when there is a high percentage, it refers to the percentage of the 75 percent that is available. For example, 92 percent of the 75 percent is available.

The following is an example of what you may see when you use diag sys logdisk usage command on a unit with no VDOMs configured:

diag sys logdisk usage

The following appears:

Total HD usage: 176MB/3011 MB

Total HD logging space: 22583MB

Total HD logging space for each vdom: 22583MB

HD logging space usage for vdom "root": 30MB/22583MB

Customizing and filtering log messages

When viewing log messages, you may want to customize and filter the information that you are seeing in the Log & Report menu (for example, Log & Report > Traffic Log > Forward Traffic). Filtering and customizing the display provides a way to view specific log information without scrolling through pages of log messages to find the information.

Customizing log messages is the process of removing or adding columns to the log display page, allowing you to view certain desired information. The most columns represent the fields from within a log message, for example, the user column represents the user field, as well as additional information. If you want to reset the customized columns on the page back to their defaults, you need to select Reset All Columns within the column title right-click menu.

Filtering information is similar to customizing, however, filtering allows you to enter specific information that indicates what should appear on the page. For example, including only log messages that appeared on February 24, between the hours of 8:00 and 8:30 am.

To customize and filter log messages

The following is an example that displays all traffic log messages that originate from the source IP address 172.20.120.24, as well as displaying only the columns:

OS Name

OS Version

Policy ID

Src (Source IP)

The following assumes that you are already on the page of the log messages you want to customize and filter. In this example, the log messages that we are customizing and filtering are in Log & Report > Forward Traffic.

On the Forward Traffic page, right click anywhere on a column title.

Right click on a column title, and mouse over Column Settings to open the list.

Select each checkmarked title to uncheck it and remove them all from the displayed columns.

Scroll down to the list of unchecked fields and select ‘OS Name’, ‘OS Version’, ‘Policy ID’, and ‘Src’ to add checkmarks next to them.

Click outside the menu, and wait for the page to refresh with the new settings in place.

Select the funnel icon next to the word Src in the title bar of the Src column.

Enter the IP you want displayed (in this example, 172.20.120.24) in the text box.

Click Apply, and wait for the page to reload.

Viewing logs from the CLI

You can easily view log messages from within the CLI. In this example, we are viewing DLP log messages.

Log in to the CLI and then enter the following to configure the display of the DLP log messages.

execute log filter category 9

execute log filter start-line 1

execute log filter view-lines 20

The customized display of log messages in the CLI is similar to how you customize the display of log messages in the web-based manager. For example, category 9 is the DLP log messages, and the start-line is the first line in the log database table for DLP log messages, and there will be 20 lines (view-lines 20) that will display.

Enter the following to view the log messages:

execute log display

The following appears below execute log display:

600 logs found

20 logs returned

along with the 20 DLP log messages.

Configuring NAC quarantine logging

NAC quarantine log messages provide information about what was banned and quarantined by a Antivirus profile. The following explains how to configure NAC quarantine logging and enable it on a policy. This procedure assumes the Antivirus profile is already in place.

To configure NAC quarantine logging

Go to Policy & Objects > IPv4 Policy.

Select the policy that you want to apply the Antivirus profile to, and then select Edit.

Within the Security Profiles section, enable Antivirus and then select the profile from the drop-down list.

Select OK.

Log in to the CLI.

Enter the following to enable NAC quarantine in the DLP sensor:

config antivirus profile

edit <profile_name>

config nac-quar log enable

end

Logging local-in policies

Local-in security policies are policies the control the flow of internal traffic, and can be used to broaden or restrict an administrator’s access privileges. These local-in policies can also be configured to log traffic and activity that the policies control.

You can enable logging of local-in policies in the CLI, with the following commands:

config system global

set gui-local-in-policy enable

end

The Local-In Policy page will then be available in Policy & Objects > Local In Policy. You can configure what local-in traffic to log in the CLI, or in Log & Report > Log Settings, under Local Traffic Logging.

When deciding what local-in policy traffic you want logged, consider the following:

Special Traffic

Traffic activity

Traffic Direction

Description

FortiGuard update annoucements

IN

All push announcements of updates that are coming from the FortiGuard system. For example, IPS or AV updates.

FortiGuard update requests

OUT

All updates that are checking for antivirus or IPS as well as other FortiGuard service updates.

This will get information from the CMDB and updated by session sync daemon.

CAPWAP

IN

This activity is logged only when a HAVE_CAPWAP is defined.

Radius

IN

This is recorded only within FortiCarrier.

NETBIOS forward

IN

Any interface that NETBIOS forward is enabled on.

RIP

IN

OSPF

IN

VRRP

IN

BFD

IN

IGMP

IN

This is recorded only when PIM is enabled.

PIM

IN

This is recorded only when PIM is enabled.

BGP

IN

This is recorded only when config bgp and bgp neightbor is enabled in the CLI.

WCCP policy

IN

Any interface that WCCP is enabled; however, if in Cache mode, this is not recorded because it is not available.

WAN Opt/ Web Cache

IN

Any interface where WAN Opt is enabled.

WANOpt Tunnel

IN

This is recorded when HAVE_WANOPT is defined.

SSL-VPN

IN

Any interface from a zone where the action in the policy is SSL VPN.

IPSEC

IN

L2TP

IN

PPTP

IN

VPD

IN

This is recorded only when FortiClient is enabled.

Web cache db test facility

IN

This is recorded only when WA_CS_REMOTE_TEST is defined.

GDBserver

IN

This is recorded only when debug is enabled.

Tracking specific search phrases in reports

It is possible to use the Web Filter to track specific search keywords and phrases and record the results for display in the report.

You should verify that the web filter profile you are using indicates what search phrases you want to track and monitor, so that the report includes this information.

Log in to the CLI and enter show webfilter profile default.This provides details about the webfilter profile being used by the security policy. In this example, the details (shown in the following in bold) indicate that safe search is enabled, but not specified or being logged.

show webfilter profile default

config webfilter profile

edit "default"

set comment "default web filtering"

set inspection-mode flow-based

set options https-scan

set post-action comfort

config web

set safe-search url

end

config ftgd-wf

config filters

edit 1

set action block

set category 2

next

edit 2

set action block

set category 7

next

edit 3

set action block

set category 8

Enter the following command syntax so that logging and the keyword for the safe search will be included in logging.

config webfilter profile

edit default

config web

set log-search enable

set keyword-match "fortinet" "easter" "easter bunny"

end

end

To test that the keyword search is working, go to a web browser and begin searching for the words that were included in the webfilter profile, such as easter.You can tell that the test works by going to Log & Report > Forward Traffic and viewing the log messages.